What Is a Passkey, and Is It Safer Than a Password?

What is a passkey?

A passkey lets you sign in to a website with your face, your fingerprint or your phone's PIN instead of a password. It's the same thing you already do to unlock your phone, just pointed at Amazon or Google instead.

Without getting too nerdy, here's what happens. When you set one up, your phone makes a secret key that never leaves your phone, and the website only gets the matching half. When you sign in, your phone and the website check that the two halves fit, and you're in. Nothing gets typed and nothing secret gets sent.

Why is a passkey safer than a password?

Because a passkey only works on the real website it was made for. That's the whole ballgame.

Most scams that go after your login work the same way. An email says there's a problem with your order or your account, you click, and you land on a page that looks exactly like the real thing. You type in your password and the scammer has it.

With a passkey, there's no password to type. If a fake Amazon page asks your phone for your passkey, your phone won't hand it over, because the fake page isn't Amazon. So even if you click the wrong link on a bad day, there's nothing to give away.

There's a second benefit people don't think about. When a big company gets hacked, the thieves are usually after the passwords. With a passkey there's no password sitting on the company's end to steal, only the half that's useless without your phone.

Why does this matter more around the holidays?

Because that's when the fake "your order has a problem" emails pile up. Everybody's ordering everything online, from Christmas presents to fly spray, so an email about an Amazon order doesn't look strange to anybody. That's exactly what the scammers are counting on.

We spent a lot of time in the fall of 2026 warning our own clients about fake emails with my name on them. Those were after money. The login version is the next step, and a passkey is the one thing that makes it just fail. (If you want the details on spotting a fake email in the first place, we wrote about that in How Can You Tell a Website Renewal Email Is a Scam?)

How do I set up a passkey?

It's honestly not a big deal. I set one up myself.

• Log in to the account the way you normally do.
• Go into your account or security settings. Amazon calls it "Login & Security."
• Look for "passkey" and choose to create one.
• Your phone asks for your face, fingerprint or PIN, and you're done.

Amazon, Google, Microsoft, Apple, eBay and Facebook all offer passkeys. If you're only going to do two, do Amazon (that's where the holiday shopping is) and then your email account, because whoever gets into your email can reset the password on almost everything else.

What can't a passkey do?

It's not magic, and I'd be doing you a disservice if I said it was.

Not every website offers passkeys yet, so you'll still have passwords for a while. A virus on your computer is still a virus. And a passkey does nothing about a scam that asks you to pay something instead of log in. For those, the rule hasn't changed: call the person or company at a number you already have, never the one in the email.

Frequently asked questions

Does Amazon get a copy of my fingerprint or face?

No. Your fingerprint and face never leave your phone. The phone checks it's you, then uses the passkey. The website never sees your face or finger.

What if I lose my phone?

On an iPhone your passkeys are kept in your iCloud account, and on Android they're kept in your Google account, so they come back when you sign in on your new phone. Most sites also still let you sign in another way, which is one more reason to keep your email account locked down.

Do I need a new phone to use a passkey?

Probably not. Most phones from the last several years support them. If your phone can unlock with your face or fingerprint, you're likely set.

Can I still use my password after I set up a passkey?

On most sites, yes. The passkey just becomes the easier, safer way in.

Let's talk

If an email about your website or your account ever doesn't feel right, call us at 979-217-1544 before you do anything with it. We'd much rather get that call.

Tom Bruch has built websites since 1998 and is the owner of Big Sky Internet Design.